VLANs in transparent mode
In transparent mode, the FortiGate unit behaves like a layer-2 bridge but can still provide services such as antivirus scanning, web filtering, spam filtering and intrusion protection to traffic. There are some limitations in transparent mode in that you cannot use SSL VPN, PPTP/L2TP VPN, DHCP server, or easily perform NAT on traffic. The limits in transparent mode apply to IEEE 802.1Q VLAN trunks passing through the unit.
VLANs and transparent mode
You can insert the FortiGate unit operating in transparent mode into the VLAN trunk without making changes to your network. In a typical configuration, the FortiGate unit internal interface accepts VLAN packets on a VLAN trunk from a VLAN switch or router connected to internal network VLANs. The FortiGate external interface forwards VLAN-tagged packets through another VLAN trunk to an external VLAN switch or router and on to external networks such as the Internet. You can configure the unit to apply different policies for traffic on each VLAN in the trunk.
To pass VLAN traffic through the FortiGate unit, you add two VLAN subinterfaces with the same VLAN ID, one to the internal interface and the other to the external interface. You then create a security policy to permit packets to flow from the internal VLAN interface to the external VLAN interface. If required, you create another security policy to permit packets to flow from the external VLAN interface to the internal VLAN interface. Typically in transparent mode, you do not permit packets to move between different VLANs. Network protection features, such as spam filtering, web filtering and anti-virus scanning, are applied through the UTM profiles specified in each security policy, enabling very detailed control over traffic.
When the FortiGate unit receives a VLAN-tagged packet at a physical interface, it directs the packet to the VLAN subinterface with the matching VLAN ID. The VLAN tag is removed from the packet, and the FortiGate unit then applies security policies using the same method it uses for non-VLAN packets. If the packet exits the FortiGate unit through a VLAN subinterface, the VLAN ID for that subinterface is added to the packet and the packet is sent to the corresponding physical interface.
There are two essential steps to configure your FortiGate unit to work with VLANs in transparent mode:
- Add VLAN subinterfaces
- Create security policies
You can also configure the protection profiles that manage antivirus scanning, web filtering and spam filtering. For more information on UTM profiles, see the UTM Guide.
Add VLAN subinterfaces
The VLAN ID of each VLAN subinterface must match the VLAN ID added by the IEEE 802.1Q-compliant router or switch. The VLAN ID can be any number between 1 and 4094, with 0 being used only for high priority frames and 4095 being reserved. You add VLAN subinterfaces to the physical interface that receives VLAN-tagged packets.
For this example, we are creating a VLAN called internal_v225 on the internal interface, with a VLAN ID of 225. Administrative access is enabled for HTTPS and SSH. VDOMs are not enabled.
To add VLAN subinterfaces in transparent mode – web-based manager
1. Go to System > Network > Interface.
2. Select Create New.
3. Enter the following information and select OK.
Name internal_v225
Type VLAN
Interface internal
VLAN ID 225
Administrative Access Enable HTTPS, and SSH. These are very secure access methods.
Comments VLAN 225 on internal interface
The FortiGate unit adds the new subinterface to the interface that you selected.
Repeat steps 2 and 3 to add additional VLANs. You will need to change the VLAN ID, Name, and possibly Interface when adding additional VLANs.
To add VLAN subinterfaces in transparent mode – CLI
config system interface edit internal_v225
set interface internal set vlanid 225
set allowaccess HTTPS SSH
set description “VLAN 225 on internal interface”
set vdom root
end
Create security policies
In transparent mode, the FortiGate unit performs antivirus and antispam scanning on each VLAN’s packets as they pass through the unit. You need security policies to permit packets to pass from the VLAN interface where they enter the unit to the VLAN interface where they exit the unit. If there are no security policies configured, no packets will be allowed to pass from one interface to another.
To add security policies for VLAN subinterfaces – web based manager
1. Go to Policy & Objects > Objects > Addresses.
2. Select Create New to add firewall addresses that match the source and destination IP addresses of VLAN packets.
3. Go to Policy & Objects > Policy > IPv4 or Policy & Objects > Policy > IPv6 and select Create New.
4. From the Incoming Interface/Zone list, select the VLAN interface where packets enter the unit.
5. From the Outgoing Interface/Zone list, select the VLAN interface where packets exit the unit.
6. Select the Source and Destination Address names that you added in step 2.
7. Select OK.
To add security policies for VLAN subinterfaces – CLI
config firewall address
edit incoming_VLAN_address
set associated-interface <incoming_VLAN_interface>
set type ipmask
set subnet <IPv4_address_mask)
next
edit outgoing_VLAN_address
set associated-interface <outgoing_VLAN_interface>
set type ipmask
set subnet <IPv4_address_mask>
next
end
config firewall policy or config firewall policy6 edit <unused_policy_number>
set srcintf <incoming_VLAN_interface>
set srcaddr incoming_VLAN_address
set destintf <outgoing_VLAN_interface>
set destaddr outgoing_VLAN_address set schedule always
set service <protocol_to_allow_on VLAN>
set action ACCEPT
next end
Example of VLANs in transparent mode
In this example, the FortiGate unit is operating in transparent mode and is configured with two VLANs: one with an ID of 100 and the other with ID 200. The internal and external physical interfaces each have two VLAN subinterfaces, one for VLAN_100 and one for VLAN_200.
The IP range for the internal VLAN_100 network is 10.100.0.0/255.255.0.0, and for the internal VLAN_200 network is 10.200.0.0/255.255.0.0.
The internal networks are connected to a Cisco 2950 VLAN switch, which combines traffic from the two VLANs onto one in the FortiGate unit internal interface. The VLAN traffic leaves the FortiGate unit on the external network interface, goes on to the VLAN switch, and on to the Internet. When the FortiGate units receives a tagged packet, it directs it from the incoming VLAN subinterface to the outgoing VLAN subinterface for that VLAN.
This section describes how to configure a FortiGate-800 unit, Cisco switch, and Cisco router in the network topology shown below.
VLAN transparent network topology
General configuration steps
The following steps summarize the configuration for this example. For best results, follow the procedures in the order given. Also, note that if you perform any additional actions between procedures, your configuration may have different results.
1. Configure the FortiGate unit which includes
- Adding VLAN subinterfaces
- Adding the security policies
2. Configure the Cisco switch and router
Configure the FortiGate unit
The FortiGate unit must be configured with the VLAN subinterfaces and the proper security policies to enable traffic to flow through the FortiGate unit.
Add VLAN subinterfaces
For each VLAN, you need to create a VLAN subinterface on the internal interface and another one on the external interface, both with the same VLAN ID.
To add VLAN subinterfaces – web-based manager
1. Go to System > Network > Interface.
2. Select Create New.
3. Enter the following information and select OK:
Name VLAN_100_int
Interface internal
VLAN ID 100
4. Select Create New.
5. Enter the following information and select OK:
Name VLAN_100_ext
Interface external
VLAN ID 100
6. Select Create New.
7. Enter the following information and select OK:
Name VLAN_200_int
Interface internal
VLAN ID 200
8. Select Create New.
9. Enter the following information and select OK:
Name VLAN_200_ext
Interface external
VLAN ID 200
To add VLAN subinterfaces – CLI
config system interface edit VLAN_100_int
set status down set type vlan
set interface internal set vlanid 100
next
edit VLAN_100_ext set status down set type vlan
set interface external set vlanid 100
next
edit VLAN_200_int set status down set type vlan
set interface internal set vlanid 200
next
edit VLAN_200_ext set status down set type vlan
set interface external set vlanid 200
end
Add the security policies
Security policies allow packets to travel between the VLAN_100_int interface and the VLAN_100_ext interface. Two policies are required; one for each direction of traffic. The same is required between the VLAN_200_int interface and the VLAN_200_ext interface, for a total of four required security policies.
To add the security policies – web-based manager
1. Go to Policy & Objects > Policy > IPv4 or Policy & Objects > Policy > IPv6 and select Create New.
2. Enter the following information and select OK:
Incoming Interface VLAN_100_int
Source Address all
Outgoing Interface VLAN_100_ext
Destination Address all
Schedule Always
Service ALL
Action ACCEPT
3. Select Create New.
4. Enter the following information and select OK:
Incoming Interface VLAN_100_ext
Source Address all
Outgoing Interface VLAN_100_int
Destination Address all
Schedule Always
Service ALL
Action ACCEPT
5. Go to Policy & Objects > Policy > IPv4 or Policy & Objects > Policy > IPv6 and select Create New.
6. Enter the following information and select OK:
Incoming Interface VLAN_200_int
Source Address all
Outgoing Interface VLAN_200_ext
Destination Address all
Schedule Always
Service ALL
Action ACCEPT
Enable NAT Enable
7. Select Create New.
8. Enter the following information and select OK:
Incoming Interface VLAN_200_ext
Source Address all
Outgoing Interface VLAN_200_int
Destination Address all
Schedule Always
Service ALL
Action ACCEPT
To add the security policies – CLI
config firewall policy or config firewall policy6 edit 1
set srcintf VLAN_100_int set srcaddr all
set dstintf VLAN_100_ext set dstaddr all
set action accept set schedule always set service ALL
next edit 2
set srcintf VLAN_100_ext set srcaddr all
set dstintf VLAN_100_int set dstaddr all
set action accept set schedule always set service ALL
next edit 3
set srcintf VLAN_200_int
set srcaddr all
set dstintf VLAN_200_ext set dstaddr all
set action accept set schedule always set service ALL
next edit 4
set srcintf VLAN_200_ext set srcaddr all
set dstintf VLAN_200_int set dstaddr all
set action accept set schedule always set service ALL
end
Configure the Cisco switch and router
This example includes configuration for the Cisco Catalyst 2900 ethernet switch, and for the Cisco Multiservice 2620 ethernet router. If you have access to a different VLAN enabled switch or VLAN router you can use them instead, however their configuration is not included in this document.
Configure the Cisco switch
On the VLAN switch, you need to define VLAN_100 and VLAN_200 in the VLAN database and then add a configuration file to define the VLAN subinterfaces and the 802.1Q trunk interface.
Add this file to the Cisco switch:
interface FastEthernet0/3 switchport access vlan 100
!
interface FastEthernet0/9 switchport access vlan 200
!
interface FastEthernet0/24
switchport trunk encapsulation dot1q switchport mode trunk
!
The switch has the following configuration:
Port 0/3 VLAN ID 100
Port 0/9 VLAN ID 200
Port 0/24 802.1Q trunk
Configure the Cisco router
You need to add a configuration file to the Cisco Multiservice 2620 ethernet router. The file defines the VLAN subinterfaces and the 802.1Q trunk interface on the router. The 802.1Q trunk is the physical interface on the router.
The IP address for each VLAN on the router is the gateway for that VLAN. For example, all devices on the internal VLAN_100 network will have 10.100.0.1 as their gateway. Add this file to the Cisco router:
!
interface FastEthernet0/0
!
interface FastEthernet0/0.1 encapsulation dot1Q 100
ip address 10.100.0.1 255.255.255.0
!
interface FastEthernet0/0.2 encapsulation dot1Q 200
ip address 10.200.0.1 255.255.255.0
!
The router has the following configuration:
Port 0/0.1 VLAN ID 100
Port 0/0.2 VLAN ID 200
Port 0/0 802.1Q trunk
Test the configuration
Use diagnostic network commands such as traceroute (tracert) and ping to test traffic routed through the network.
Testing traffic from VLAN_100 to VLAN_200
In this example, a route is traced between the two internal networks. The route target is a host on VLAN_200. The Windows traceroute command tracert is used.
From VLAN_100, access a Windows command prompt and enter this command:
C:\>tracert 10.1.2.2
Tracing route to 10.1.2.2 over a maximum of 30 hops:
1 <10 ms <10 ms <10 ms 10.1.1.1
2 <10 ms <10 ms <10 ms 10.1.2.2
Trace complete.
Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!
